This vulnerability exists in the ngx_http_v3_module of NGINX Plus and NGINX Open Source when HTTP/3 is used with OpenSSL versions <= 3.5.0 under certain configurations. A limited heap buffer overflow can occur during TLS handshake processing in a non-deterministic manner beyond attacker control. This can lead to a denial-of-service condition via worker process restart or limited data corruption. The vulnerability does not expose the control plane and is limited to the data plane. The affected versions include NGINX Plus >=37.1.0.1 <37.1.1.1, >=37.0.0.1 <37.0.6.1, and NGINX Open Source >=1.29.2 <1.31.6 and >=1.30.4 <1.30.5.

Remote attackers may cause denial-of-service by triggering a heap buffer overflow that leads to NGINX worker process restarts or limited data corruption. There is no impact on confidentiality or control plane operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the current data. Users should monitor F5's advisories for updates and consider upgrading OpenSSL beyond version 3.5.0 or disabling HTTP/3 if feasible until a fix is available.